Detection Details - DeFender X

Informational

Detection ID
Detection Name
Description
Hostname
User: ubuntu
Tactic: Execution
Technique: User Execution
Objective: Follow Through
Event Time: 2025-12-22 08:02:41
Received: 2025-12-22 11:48:43

Process Information

File Name

python.exe

File Path

\Device\HarddiskVolume3\Users\ubuntu\scoop\apps\python\3.13.2\python.exe

Command Line

"C:\app\cortex-xdr-siem-test\.venv\Scripts\python.exe"  mega_incident_generator.py --rounds 2 --interval 30

Process ID

26930287020

Parent PID

26928718552

SHA256

7d96a4ed35d6e596cd9dd8933feafc66349cc21f75be3b15c89fd336e50140c1 VT

MD5

5b4a9fba45e770366c5a8f973f6c6ab1

Disposition

0
Detection, standard detection.

Raw JSON Data

{
  "metadata": {
    "customerIDString": "84393bf974fd44bda943a25a6a7bc27f",
    "offset": 157990,
    "eventType": "EppDetectionSummaryEvent",
    "eventCreationTime": 1766358161000,
    "version": "1.0"
  },
  "event": {
    "ProcessStartTime": 1766358002,
    "ProcessEndTime": 1766358112,
    "ProcessId": 26930287020,
    "ParentProcessId": 26928718552,
    "Hostname": "BOOK-R0BE6S1NC3",
    "UserName": "ubuntu",
    "Name": "Known Malware",
    "Description": "A process has written a known EICAR test file. Review the files written by the triggered process.",
    "Severity": 10,
    "SeverityName": "Informational",
    "FileName": "python.exe",
    "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\scoop\\apps\\python\\3.13.2\\python.exe",
    "CommandLine": "\u0022C:\\app\\cortex-xdr-siem-test\\.venv\\Scripts\\python.exe\u0022  mega_incident_generator.py --rounds 2 --interval 30 ",
    "SHA256String": "7d96a4ed35d6e596cd9dd8933feafc66349cc21f75be3b15c89fd336e50140c1",
    "MD5String": "5b4a9fba45e770366c5a8f973f6c6ab1",
    "SHA1String": "0000000000000000000000000000000000000000",
    "LogonDomain": "BOOK-R0BE6S1NC3",
    "FilesAccessed": [
      {
        "Timestamp": 1766358040,
        "FileName": "cacert.pem",
        "FilePath": "\\Device\\HarddiskVolume3\\app\\cortex-xdr-siem-test\\.venv\\Lib\\site-packages\\certifi"
      },
      {
        "Timestamp": 1766358041,
        "FileName": "cacert.pem",
        "FilePath": "\\Device\\HarddiskVolume3\\app\\cortex-xdr-siem-test\\.venv\\Lib\\site-packages\\certifi"
      },
      {
        "Timestamp": 1766358072,
        "FileName": "cacert.pem",
        "FilePath": "\\Device\\HarddiskVolume3\\app\\cortex-xdr-siem-test\\.venv\\Lib\\site-packages\\certifi"
      },
      {
        "Timestamp": 1766358073,
        "FileName": "cacert.pem",
        "FilePath": "\\Device\\HarddiskVolume3\\app\\cortex-xdr-siem-test\\.venv\\Lib\\site-packages\\certifi"
      },
      {
        "Timestamp": 1766358112,
        "FileName": "cacert.pem",
        "FilePath": "\\Device\\HarddiskVolume3\\app\\cortex-xdr-siem-test\\.venv\\Lib\\site-packages\\certifi"
      }
    ],
    "FilesWritten": [
      {
        "Timestamp": 1766358028,
        "FileName": "keylogger.vbs",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_scripts_9722"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "malware.exe",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_eicar_5806"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "amsi-bypass.ps1",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_scripts_9722"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "inject.dll",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_pe_9562"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "downloader.js",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_scripts_9722"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "invoke-mimikatz.ps1",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_scripts_9722"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "rootkit.sys",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_pe_9562"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "launcher.hta",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_scripts_9722"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "shellcode-runner.ps1",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_scripts_9722"
      },
      {
        "Timestamp": 1766358028,
        "FileName": "virus.bat",
        "FilePath": "\\Device\\HarddiskVolume3\\Users\\ubuntu\\AppData\\Local\\Temp\\xdr_eicar_5806"
      }
    ],
    "FalconHostLink": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/84393bf974fd44bda943a25a6a7bc27f:ind:024efd237c2d4f87958607652cb04c8b:26930287020-10418-3806480?_cid=g04000x7oomvbbtvcerklzeap3llo7ue",
    "AgentId": "024efd237c2d4f87958607652cb04c8b",
    "DnsRequests": [
      {
        "DomainName": "evil-c2.example.com",
        "RequestType": "A",
        "LoadTime": 1766358030,
        "InterfaceIndex": 0
      },
      {
        "DomainName": "malware.test.local",
        "RequestType": "A",
        "LoadTime": 1766358030,
        "InterfaceIndex": 0
      },
      {
        "DomainName": "beacon.attacker.net",
        "RequestType": "A",
        "LoadTime": 1766358030,
        "InterfaceIndex": 0
      }
    ],
    "CompositeId": "84393bf974fd44bda943a25a6a7bc27f:ind:024efd237c2d4f87958607652cb04c8b:26930287020-10418-3806480",
    "LocalIP": "172.27.1.19",
    "MACAddress": "00-72-ee-3e-51-84",
    "Tactic": "Execution",
    "Technique": "User Execution",
    "Objective": "Follow Through",
    "PatternDispositionDescription": "Detection, standard detection.",
    "PatternDispositionValue": 0,
    "PatternDispositionFlags": {
      "Indicator": false,
      "Detect": false,
      "InddetMask": false,
      "SensorOnly": false,
      "Rooting": false,
      "KillProcess": false,
      "KillSubProcess": false,
      "QuarantineMachine": false,
      "QuarantineFile": false,
      "PolicyDisabled": false,
      "KillParent": false,
      "OperationBlocked": false,
      "ProcessBlocked": false,
      "RegistryOperationBlocked": false,
      "CriticalProcessDisabled": false,
      "BootupSafeguardEnabled": false,
      "FsOperationBlocked": false,
      "HandleOperationDowngraded": false,
      "KillActionFailed": false,
      "BlockingUnsupportedOrDisabled": false,
      "SuspendProcess": false,
      "SuspendParent": false,
      "ContainmentFileSystem": false
    },
    "ParentImageFileName": "python.exe",
    "ParentCommandLine": "\u0022C:\\app\\cortex-xdr-siem-test\\.venv\\Scripts\\python.exe\u0022  mega_incident_generator.py --rounds 2 --interval 30 ",
    "GrandParentImageFileName": "cmd.exe",
    "GrandParentCommandLine": "C:\\windows\\SYSTEM32\\cmd.exe /c \u0022\u0022C:\\app\\cortex-xdr-siem-test\\xdr_incident_runner.bat\u0022\u0022",
    "HostGroups": "4f5aa5f1cdc6441982cf5c58e4b5d75a",
    "PatternId": 10418,
    "SourceVendors": "CrowdStrike",
    "SourceProducts": "Falcon Insight",
    "DataDomains": "Endpoint",
    "AggregateId": "aggind:024efd237c2d4f87958607652cb04c8b:17576755488",
    "Type": "ldt",
    "ParentImageFilePath": "\\Device\\HarddiskVolume3\\app\\cortex-xdr-siem-test\\.venv\\Scripts\\python.exe",
    "GrandParentImageFilePath": "\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe",
    "LocalIPv6": "",
    "PlatformId": "0",
    "PlatformName": "Windows",
    "MitreAttack": [
      {
        "Tactic": "Execution",
        "TacticID": "TA0002",
        "Technique": "User Execution",
        "TechniqueID": "T1204",
        "PatternID": 10418
      }
    ],
    "CloudIndicator": false,
    "RiskScore": 10
  }
}